Energy production system with intelligent intrusion detection

Abstract

A system includes an energy production device, a tampering detection system comprising a plurality of sensors, and a control system in communication with the plurality of sensors. The control system is configured to detect a candidate for a tampering event, determine if the candidate is a tampering or a normal operational error by comparing a first order condition to a predetermined threshold, and, when the predetermined threshold is not met, comparing the candidate to a subsequent order condition until the threshold is met, and direct an undertaking of a countermeasure when the candidate is a determined tampering or undertaking a maintenance when the candidate is a determined normal operational error.

What is claimed is: 
     
       1. A system comprising:
 an energy production device; 
 a tampering detection system comprising a plurality of sensors; and 
 a control system in communication with the plurality of sensors and configured to:
 detect a candidate for a tampering event, wherein the candidate is a detected break or discontinuity in an electrical signal surrounding the energy production device; 
 determine if there is a stoppage in current to the electrical signal from a primary external power source; 
 determine if the primary external power source is reconnected within a predetermined period of time, and, when not reconnected during the predetermined period of time, direct the undertaking of a countermeasure; 
 determine if the candidate is a tampering or a normal operational error by comparing a first order condition to a predetermined threshold, and, when the predetermined threshold is not met, comparing the candidate to a subsequent order condition until a threshold is met; and 
 direct an undertaking of the countermeasure when the candidate is a determined tampering or undertaking a maintenance when the candidate is a determined normal operational error. 
 
 
     
     
       2. The system of  claim 1 , wherein the first order condition is based on data measured by a first sensor of the plurality of sensors. 
     
     
       3. The system of  claim 2 , wherein subsequent order conditions are based on data measured by additional sensors of the plurality of sensors. 
     
     
       4. The system of  claim 1 , wherein the control system is configured to determine, based on additional data received at a subsequent time, that a determined tampering was an actual tampering or that a determined tampering was an actual normal operational error. 
     
     
       5. The system of  claim 4 , wherein the control system is configured to adjust the predetermined threshold based on the determined tampering being an actual tampering. 
     
     
       6. The system of  claim 4 , wherein the control system is configured to adjust the predetermined threshold based on the determined tampering being an actual normal operational error. 
     
     
       7. The system of  claim 4 , wherein the control system is configured to adjust the predetermined threshold based on the determined normal operational error being an actual normal operational error. 
     
     
       8. The system of  claim 4 , wherein the control system is configured to adjust the predetermined threshold based on the determined normal operational error being an actual tampering. 
     
     
       9. The system of  claim 4 , wherein undertaking a countermeasure when the candidate is a determined tampering is based on a comparison of the first order condition to another threshold that is different than the threshold. 
     
     
       10. The system of  claim 1 , wherein the control system is configured to determine if there is a stoppage in current to the electrical signal from a secondary external power source. 
     
     
       11. A method comprising:
 detecting a candidate for a tampering event, wherein the candidate is a detected break or discontinuity in an electrical signal surrounding an energy production device; 
 determining if there is a stoppage in current to the electrical signal from a primary external power source; 
 determining if the primary external power source is reconnected within a predetermined period of time, and, when not reconnected during the predetermined period of time, direct the undertaking of a countermeasure; 
 determining if the candidate is a tampering or a normal operational error by comparing a first order condition to a predetermined threshold, and, when the predetermined threshold is not met, comparing the candidate to a subsequent order condition until a threshold is met; and 
 directing an undertaking of the countermeasure when the candidate is a determined tampering, or undertaking a maintenance when the candidate is a determined normal operational error. 
 
     
     
       12. The method of  claim 11 , wherein the first order condition is based on data measured by a first sensor of a plurality of sensors. 
     
     
       13. The method of  claim 12 , wherein subsequent order conditions are based on data measured by additional sensors of the plurality of sensors of a tampering detection system. 
     
     
       14. The method of  claim 11 , determining, based on additional data received at a subsequent time, that a determined tampering was an actual tampering or that a determined tampering was an actual normal operational error. 
     
     
       15. The method of  claim 14 , adjusting the predetermined threshold based on the determined tampering being an actual tampering. 
     
     
       16. The method of  claim 14 , adjusting the predetermined threshold based on the determined tampering being an actual normal operational error. 
     
     
       17. The method of  claim 14 , adjusting the predetermined threshold based on the determined normal operational error being an actual normal operational error. 
     
     
       18. The method of  claim 14 , adjusting the predetermined threshold based on the determined normal operational error being an actual tampering. 
     
     
       19. The method of  claim 14 , wherein directing an undertaking of a countermeasure when the candidate is a determined tampering is based on a comparison of the first order condition to another threshold that is different than the threshold. 
     
     
       20. A non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium storing instructions to be implemented on a control system including at least one processor, the control system having communication with a plurality of sensors monitoring an energy production device, the instructions when executed by the at least one processor cause the control system to perform a method for detecting tampering of the energy production device, the method comprising:
 detecting a candidate for a tampering event, wherein the candidate is a detected break or discontinuity in an electrical signal surrounding an energy production device; 
 determining if there is a stoppage in current to the electrical signal from a primary external power source; 
 determining if the primary external power source is reconnected within a predetermined period of time, and, when not reconnected during the predetermined period of time, direct the undertaking of a countermeasure; 
 determining if the candidate is a tampering or a normal operational error by comparing a first order condition to a predetermined threshold, and, when the predetermined threshold is not met, comparing the candidate to a subsequent order condition until a threshold is met; and 
 directing an undertaking of the countermeasure when the candidate is a determined tampering, or undertaking a maintenance when the candidate is a determined normal operational error.